More than a million users followed at least one page

Facebook said it’s found and removed hundreds more pages, organic content and ads meant to spread misinformation in the U.S. and abroad. However, while many of the “bad actors” in the past have been suspected to have come from Russia, the latest batch seems to have originated from another nation: Iran.

In a blog post published last night, the social network said it removed 652 pages, groups and accounts targeting users not just in the U.S., but also in the Middle East, Latin America and the United Kingdom. Facebook credited the cybersecurity firm FireEye for a tip back in July about a network of pages called “Liberty Front Press,” then led to an investigation by Facebook that found pages dating all the way back to 2013.

“We are able to link this network to Iranian state media through publicly available website registration information, as well as the use of related IP addresses and Facebook Pages sharing the same admins,” wrote Nathaniel Gleicher, Facebook’s head of cybersecurity policy. “For example, one part of the network, ‘Quest 4 Truth,’ claims to be an independent Iranian media organization, but is in fact linked to Press TV, an English-language news network affiliated with Iranian state media.”

As a result of the investigation, Facebook found 74 pages, 70 accounts and three groups on Facebook, along with another 76 accounts on Instagram. About 155,000 Facebook accounts followed at least one of the pages, while 2,300 accounts joined at least one group. On Instagram, 48,000 users followed at least one of the bad actors’ accounts. Meanwhile, more than $6,000 was spent on ads on Facebook and Instagram from January 2015 to August 2018, which Facebook said were paid for in both U.S. and Australian currency.

The content found included English language text next to memes criticizing politicians including President Donald Trump while also promoting British Jeremy Corbyn—the British politician who has been in favor of Brexit—along with other content mocking the UK’s decision to leave the European Union. Other content included Arabic text and featured images such as one of German Chancellor Angela Merkel shaking hands with Russia President Vladimir Putin.

A second part of the investigation found another batch of accounts dating back to 2016, including 12 pages and 66 accounts on Facebook and another nine on Instagram. Among those, 15,000 accounts followed at least one Facebook page, while more than 1,100 followed at least one on Instagram. However, in this batch from “Liberty Front Press,” Facebook found no ads or events created.

On its website, FireEye also provided details of how it found and identified the actors on Facebook by tracing various accounts back to shared email addressed.

“The activity we have uncovered highlights that multiple actors continue to engage in and experiment with online, social media-driven influence operations as a means of shaping political discourse,” the company said in a blog post about the findings. “These operations extend well beyond those conducted by Russia, which has often been the focus of research into information operations over recent years. Our investigation also illustrates how the threat posed by such influence operations continues to evolve, and how similar influence tactics can be deployed irrespective of the particular political or ideological goals being pursued.”

Perhaps the largest number of inauthentic accounts were found in a third part of the investigation, which uncovered another 168 pages and 140 accounts on Facebook along with 31 accounts on Instagram. According to Facebook, about 813,000 users followed at least one Facebook page, while more than 10,000 followed at least one account on Instagram. On the advertising side, more than $6,000 was spent using U.S. dollars, Turkish lira and Indian rupees, with the first ads found dating back to 2012 and the last ending in April 2018.